1. Field of Invention
The present invention relates generally to the field of content inspection. More specifically, the present invention is related to content inspection of encrypted network traffic.
2. Discussion of Prior Art
Businesses have increasingly started using networks, such as the Internet, as a tool for facilitating communications and advancing commerce. Employees in a business use the Internet to communicate with customers and suppliers in a relatively inexpensive manner. Employees also use the Internet to gather information to keep up-to-date with the market and educate themselves with new technologies and products, thereby saving valuable research time and money.
Encryption is used as a means for guarantying privacy in communications over a public network such as the Internet. A popular encryption protocol used over the Internet is the Secure Sockets Layer (SSL) protocol. SSL was developed by Netscape® for transmitting private documents via the Internet. SSL works by using a private key to encrypt data that's transferred over the SSL connection. Both Netscape Navigator™ and Internet Explorer™ support SSL, and many Web sites use the protocol to obtain confidential user information, such as credit card numbers. By convention, URLs that require an SSL connection start with “HTTPS:” instead of “HTTP:”.
FIG. 1 illustrates a time-line diagram of a typical SSL session 1000. First, in step 102, the user contacts the server (for establishing a secure connection) by sending a “CLIENT HELLO” message. The client identifies, to the server, the various cryptographic systems it can support. In response, in step 104, the server sends a “SERVER HELLO” message with the server's chosen cryptographic system. Next, in step 106, the server sends a certificate message containing the server's Public Key Certificate. The user can verify that the certificate belongs to the server through a certificate authority (a third party) that approves the certificate. In step 108, the server notifies the client that the “SERVER HELLO” message has ended. In step 111, the client sends a “CLIENT KEY EXCHANGE” that contains a random sequence of numbers that have been encrypted using the server's public key, wherein the encrypted data becomes the new secret key. In step 112, the client sends a “CHANGE CIPHER SPEC” that notifies the server that all subsequent communications will be encrypted. Next, in step 114, the client sends a “FINISHED” message notifying the server that it has completed the handshake message.
In step 116, the server sends a “CHANGE CIPHER SPEC” that notifies the client that all subsequent communications will be encrypted, and, in step 118, the server sends a “FINISHED” message notifying the server that it has completed the handshake exchange. After establishing a session as per FIG. 1, a client and a server can start communicating in a secure manner via the SSL protocol.
Access to a public network, such as the Internet, presents several problems from a company's perspective. For example, there are at least two issues that need to be addressed by a company. First, while accessing the Internet, the users are vulnerable to attacks (e.g., viruses) that can damage the company's data and infrastructure. Second, employees have unrestricted access to the Internet and there is no check on their access to information not pertinent to work, which results in the improper usage of both an employee's time and a company's communication bandwidth. Hence, it would be beneficial for a company to prevent attacks on its infrastructure and limit unnecessary bandwidth usage.
Filtering gateways have been used in the prior art for protecting employees from vulnerabilities and limiting their access to proper resources. Such gateways are placed in the edge of the company network, such that the relevant part of the communication that requires inspection goes through the gateway. The gateway checks the traffic and knows to block or report on any illegal traffic that arrives through it, either from the internal network or back from the Internet. This application is easy to install and manage, but it has many limitations. One drawback with prior art filtering gateways is that secure transactions cannot be inspected because much of the content is encrypted.
Another prior art approach involves the use of host-based software that is installed on each of the employee's personal computer (PC). A pitfall associated with this approach is that this option is hard to manage because each PC can have a different operating system, thereby causing problems during installation of the host-based software. Another pitfall is that previously installed software resident on a PC can conflict with the newly installed host-based filtering software, potentially rendering the host-based software ineffective. Furthermore, a lot of time and effort is involved in updating the host-based filtering software in each PC when new inspection logic is available.
The following references provide for a general teaching in the area of content security and inspection, but they fail to provide for many of the limitations of the present invention.
The U.S. patent publication 2003/0084279 A1 to Campagna teaches a monitoring system for a corporate network, wherein cryptographically protected data is routed through a monitoring server as part of its exchange between a client and a server. The monitoring server analyzes decoded data to determine the presence/absence of “suspect” data. The monitoring server has virus scanning and a firewall/filtering capability resident within which are used to detect viruses and data that a corporation does not want transmitted outside the corporate network.
U.S. Pat. No. 6,636,838 to Perlman et al. provides for a system that performs content screening, via a content screener located within a firewall, on a message that is protected by end-to-end encryption. The content screener in the firewall screens incoming messages for harmful code, such as a computer virus. It can also screen the message to detect a policy violation within the message, such as receiving a communication from a non-work-related source. U.S. Pat. Nos. 6,560,705 and 6,546,486 also appear to provide a similar teaching.
The U.S. Pat. No. 5,884,025 to Baehr et al. discloses a screening system for screening data packets transmitted between a network to be protected, such as a private network, and another network, such as a public network. Packets received at the screening system are filtered based upon their contents, state information and other criteria, including their source and destination. The packets may be allowed through, with or without alteration of their data, IP address, etc; or the packets may be dropped, with or without an error message generated to sender of the packets.
The U.S. Pat. No. 6,393,568 to Ranger et al. teaches a computer-based encryption and decryption system that provides content analysis through a content inspection mechanism. The content inspection mechanism analyzes decrypted content for things such as virus patterns, keywords, unknown program format, or any other content-based criteria.
The U.S. Pat. No. 6,701,432 to Deng et al. provides for a gateway that includes a firewall engine for screening packets transferred over a network. The firewall engine is operable to retrieve packets from memory and screen each packet prior to forwarding a given packet through the gateway.
Whatever the precise merits, features, and advantages of the above cited references, they fail to achieve or fulfill the purpose of the present invention.